Something perhaps relevant, small companies tend to have a small admin function, who use the same password for everything.

Not everyone in the world knows much to change their password, especially if they're using a desktop client such as Outlook. It just connects.

So it is possible that everyone in the company was logging in with the same password as the exposed email.